EUVD-2026-76565
GHSA-q4wh-f6ch-5m9w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Needs a malicious/compromised monitor or MITM on the messenger (AV:A, AC:H); no client auth (PR:N); single-bit stack OOB write yields memory corruption/crash so A:H, I:L, C:N.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
MDSMap export_targets entries are monitor controlled. check_new_map() uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can make set_bit() write past the end of the array.
Reject ranks outside CEPH_MAX_MDS while decoding the map. Do not validate against possible_max_rank here because maps may legitimately reference ranks beyond a temporarily reduced max_mds.
AnalysisAI
Out-of-bounds write in the Linux kernel CephFS client (ceph module) lets a malicious or compromised Ceph monitor corrupt kernel memory on any client with a mounted CephFS. The MDSMap decoder failed to bound export_targets rank values against CEPH_MAX_MDS, and check_new_map() then used each attacker-controlled rank as a bit index into a fixed-size stack bitmap, causing set_bit() to write past the array. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) a host with a mounted CephFS using the in-kernel ceph client, and (2) the ability to deliver a crafted MDSMap containing an export_targets rank >= CEPH_MAX_MDS - which in practice means control of a Ceph monitor (compromised/malicious monitor) or a man-in-the-middle position on an unauthenticated/unencrypted Ceph messenger session, since MDSMap contents are monitor-controlled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update to Linux kernel 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 (or your distribution's backport carrying the equivalent commits 736adee11af3 / 4d298880f82c / 96c3f5fbb0d5 / aedc9053d909). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately (within 24 hours) identify all systems with mounted CephFS filesystems and document their current Linux kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today